<!DOCTYPE HTML>
<html lang="en-US">

<!-- OneTrust Cookies Consent Notice start for trendmicro.com -->
<script type="text/javascript" src="https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js"></script>
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="821060e3-3f9c-4a2f-8613-8e0db4841f79"></script>
<script type="text/javascript">function OptanonWrapper() { }</script>
<!-- OneTrust Cookies Consent Notice end for trendmicro.com -->

   	
	
	

	<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script>
	<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script>

	<script type="text/javascript">
		if (typeof Granite !== "undefined" && Granite.I18n){
			Granite.I18n.setLocale("en_us" || "en");
		}
	</script>
	
    <head>
    
    
    
    
    <meta charset="UTF-8"/>
    <meta name="viewport" content="width=device-width"/>
	<meta name="description" content="While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor&#39;s server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we&#39;ve dubbed SprySOCKS due to its swift behavior and SOCKS implementation."/>
	<meta name="robots" content="index,follow"/>
	<meta name="keywords" content="malware,apt &amp; targeted attacks,research,articles, news, reports"/>
	<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/>
	<meta name="template" content="article1withouthero"/>
    <meta property="article:published_time" content="2023-09-18"/>
    <meta property="article:tag" content="malware"/>
    <meta property="article:section" content="research"/>
    
    <link rel="icon" type="image/ico" href="/content/dam/trendmicro/favicon.ico"/>
	<link rel="canonical" href="https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html"/>

    <title>Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement</title>
			 
    

    <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600" rel="stylesheet"/>
<link href="//customer.cludo.com/css/296/1798/cludo-search.min.css" type="text/css" rel="stylesheet"/>



    
    
    

    
    
    
    
<link rel="stylesheet" href="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css" type="text/css">
<link rel="stylesheet" href="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css" type="text/css">



    

    

    <script src="//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js"></script>
	<meta property="og:url" content="https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html"/>
<meta property="og:title" content="Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement"/>
<meta property="og:description" content="While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation."/>
<meta property="og:site_name" content="Trend Micro"/>
<meta property="og:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/23/sprysocks-cover.png"/>
<meta property="og:locale" content="en_US"/>

	<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:site" content="@TrendMicro"/>
<meta name="twitter:title" content="Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement"/>
<meta name="twitter:description" content="While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation."/>
<meta name="twitter:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/23/sprysocks-cover.png"/>


<script>(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"false","rua.upre":"false","rua.cpre":"false","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans":"","rua.cook":"false","rua.ims":"false","rua.ufprl":"false","rua.cfprl":"false","rua.isuxp":"false","rua.texp":"norulematch"}]);</script>
                              <script>!function(e){var n="https://s.go-mpulse.net/boomerang/";if("False"=="True")e.BOOMR_config=e.BOOMR_config||{},e.BOOMR_config.PageParams=e.BOOMR_config.PageParams||{},e.BOOMR_config.PageParams.pci=!0,n="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="LJA84-589LU-SVNVV-WKPLQ-NBTC7",function(){function e(){if(!o){var e=document.createElement("script");e.id="boomr-scr-as",e.src=window.BOOMR.url,e.async=!0,i.parentNode.appendChild(e),o=!0}}function t(e){o=!0;var n,t,a,r,d=document,O=window;if(window.BOOMR.snippetMethod=e?"if":"i",t=function(e,n){var t=d.createElement("script");t.id=n||"boomr-if-as",t.src=window.BOOMR.url,BOOMR_lstart=(new Date).getTime(),e=e||d.body,e.appendChild(t)},!window.addEventListener&&window.attachEvent&&navigator.userAgent.match(/MSIE [67]\./))return window.BOOMR.snippetMethod="s",void t(i.parentNode,"boomr-async");a=document.createElement("IFRAME"),a.src="about:blank",a.title="",a.role="presentation",a.loading="eager",r=(a.frameElement||a).style,r.width=0,r.height=0,r.border=0,r.display="none",i.parentNode.appendChild(a);try{O=a.contentWindow,d=O.document.open()}catch(_){n=document.domain,a.src="javascript:var d=document.open();d.domain='"+n+"';void(0);",O=a.contentWindow,d=O.document.open()}if(n)d._boomrl=function(){this.domain=n,t()},d.write("<bo"+"dy onload='document._boomrl();'>");else if(O._boomrl=function(){t()},O.addEventListener)O.addEventListener("load",O._boomrl,!1);else if(O.attachEvent)O.attachEvent("onload",O._boomrl);d.close()}function a(e){window.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!window.BOOMR||!window.BOOMR.version&&!window.BOOMR.snippetExecuted){window.BOOMR=window.BOOMR||{},window.BOOMR.snippetStart=(new Date).getTime(),window.BOOMR.snippetExecuted=!0,window.BOOMR.snippetVersion=12,window.BOOMR.url=n+"LJA84-589LU-SVNVV-WKPLQ-NBTC7";var i=document.currentScript||document.getElementsByTagName("script")[0],o=!1,r=document.createElement("link");if(r.relList&&"function"==typeof r.relList.supports&&r.relList.supports("preload")&&"as"in r)window.BOOMR.snippetMethod="p",r.href=window.BOOMR.url,r.rel="preload",r.as="script",r.addEventListener("load",e),r.addEventListener("error",function(){t(!0)}),setTimeout(function(){if(!o)t(!0)},3e3),BOOMR_lstart=(new Date).getTime(),i.parentNode.appendChild(r);else t(!1);if(window.addEventListener)window.addEventListener("load",a,!1);else if(window.attachEvent)window.attachEvent("onload",a)}}(),"".length>0)if(e&&"performance"in e&&e.performance&&"function"==typeof e.performance.setResourceTimingBufferSize)e.performance.setResourceTimingBufferSize();!function(){if(BOOMR=e.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var n=""=="true"?1:0,t="",a="kbjpooqccqeokzo3l24a-f-77f32772b-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,o={"ak.v":"36","ak.cp":"1340666","ak.ai":parseInt("807181",10),"ak.ol":"0","ak.cr":67,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"6fc4964","ak.r":29288,"ak.a2":n,"ak.m":"a","ak.n":"essl","ak.bpcip":"80.82.247.0","ak.cport":59462,"ak.gh":"2.16.165.151","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.csrc":"-","ak.acc":"reno","ak.t":"1708875448","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==LBpEbqnR84wC5DnnBa8BEE/lsGdndQ3KUqZ7g42ys4KZw1H6jC4e/scZ/psXv0ryYgNem1IjjU/52noNWVI2/QPglJDMMTFShouvV1oSTV0B5m41c35BPEz1Dyv00xbINE0YKNUdSJ11tqUfes/7pwyfM+qamFfXbhmuEck/r4VP7WH8JvsfxcdIedfOSAym8lmCyRzCCosv2NgC+yMX748CyPRTOWW1mfu5Hz804x70ltaw78jFEeYLGWYmYkRUIYPwIufnVDD3Hk0rnfcbgXgaJ6oTZkLpu0Tuy5bA9yH4Em4K5RvZmLlrXrdDj0vjFg3AgAvd+jd+UHOaT7P9dAz10jDnlD22+TWBMuPHrN4sRCRGWUepC8XWIlJdiDs4REHBotRsiTkUTXb1/yOlHYFnBkOsE3pBso01X1U9EIg=","ak.pv":"28","ak.dpoabenc":"","ak.tf":i};if(""!==t)o["ak.ruds"]=t;var r={i:!1,av:function(n){var t="http.initiator";if(n&&(!n[t]||"spa_hard"===n[t]))o["ak.feo"]=void 0!==e.aFeoApplied?1:0,BOOMR.addVar(o)},rv:function(){var e=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(e)}};BOOMR.plugins.AK={akVars:o,akDNSPreFetchDomain:a,init:function(){if(!r.i){var e=BOOMR.subscribe;e("before_beacon",r.av,null,null),e("onbeacon",r.rv,null,null),r.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head>
    
    <body class="articlepage page basicpage context-business">
		<!-- Page Scroll: Back to Top -->
		<a id="page-scroll" title="VerticalPageScroll" href="javascript:jumpScroll($(this).scrollTop());">
			<span class="icon-chevron-up"></span>
		</a>

        
                      
     		<!-- /* Data Layers */ -->
			<script type="text/javascript">
				var utag_data = {"customer_cookie_type":"business","language_code":"en_us","page_name":"research/23/i/earth-lusca-employs-new-linux-backdoor/en_us","category_id":"en_us/research/23/i/earth-lusca-employs-new-linux-backdoor","page_type":"unknown","site_section":"research","post_author":"Joseph C Chen|Threat Researcher,Jaromir Horejsi|Threat Researcher","post_date":"2023-09-18"};
			</script>
			<script type="text/javascript">
				window.adobeDigitalData = typeof(window.adobeDigitalData) != "undefined" ? window.adobeDigitalData : [];
				window.adobeDigitalData.push( {"pageID":"c67615a2a450","articleTitle":"Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement","description":"While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server \u2014 a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.","thumbnailUrl":"/content/dam/trendmicro/global/en/research/thumbnails/23/sprysocks-cover.png","pageUrl":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","publishedDate":"2023-09-18","pageTag":"malware","pageSection":"research","pageMedium":"articles, news, reports"} );
			</script>

			<script type="text/javascript">(function(a,b,c,d){a='//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js';b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);})();</script>

            



            
<div class="businessHeaderV1">




<div class="headerAssemblyV1"><div class="headerassemblyv1 headerAssemblyV1">


<header class="page-header">

	
	<nav>
		<div class="header-bar">
			<div class="logo">
				
				<a id="header-logo" href="/en_us/business.html">
					<img src="/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg"/>
					<p>Business</p>
				</a>
			</div>
			<div class="inner-nav-wrapper">
				<span class="material-symbols-outlined search-icon">search</span>
				<span class="material-symbols-outlined close-search-icon">close</span>
				<input type="checkbox" id="checkbox" class="hamburger-menu"/>
				<div aria-label="Menu" class="hamburger"></div>
			</div>
		</div>

		<div class="hamburger-wrapper">
			<div class="mainNavMenuV1"><div class="mainNavMenu mainNavMenuV1">



<div class="list-wrapper inital-list-wrapper">
	<ul class="menu nav-level-0">
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Solutions</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Challenge</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/cyber-risk.html">Understand, Prioritize &amp; Mitigate Risks</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Understand, Prioritize &amp; Mitigate Risks</div>
			<p class="copy">Improve your risk posture with attack surface management</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cyber-risk.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Protect Cloud-Native Apps</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Protect Cloud-Native Apps</div>
			<p class="copy">Security that enables business outcomes</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Protect Your Hybrid World</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Protect Your Hybrid, Multi-Cloud World</div>
			<p class="copy">Gain visibility and meet business needs with security</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/infrastructure-security.html">Securing Your Borderless Workforce</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Securing Your Borderless Workforce</div>
			<p class="copy">Connect with confidence from anywhere, on any device</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/infrastructure-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/network-security.html">Eliminate Network Blind Spots</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Eliminate Network Blind Spots</div>
			<p class="copy">Secure users and key operations throughout your environment</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/network-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/detection-response.html">See More. Respond Faster.</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">See More. Respond Faster.</div>
			<p class="copy">Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/detection-response.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/managed-services.html">Extend Your Team</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Extend Your Team. Respond to Threats Agilely</div>
			<p class="copy">Maximize effectiveness with proactive risk reduction and managed services</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/managed-services.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/zero-trust.html">Operationalizing Zero Trust</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Operationalizing Zero Trust</div>
			<p class="copy">Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/zero-trust.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Role</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/ciso.html">CISO</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">CISO</div>
			<p class="copy">Drive business value with measurable cybersecurity outcomes</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/ciso.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/soc.html">SOC Manager</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">SOC Manager</div>
			<p class="copy">See more, act faster</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/soc.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Infrastructure Manager</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Infrastructure Manager</div>
			<p class="copy">Evolve your security to mitigate threats quickly and effectively</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/cloud-developer.html">Cloud Builder and Developer</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Builder and Developer</div>
			<p class="copy">Ensure code runs only as intended</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-developer.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/cloud-operations.html">Cloud Security Ops</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Security Ops</div>
			<p class="copy">Gain visibility and control with security designed for cloud environments</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-operations.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Industry</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for/healthcare.html">Healthcare</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Healthcare</div>
			<p class="copy">Protect patient data, devices, and networks while meeting regulations</p>
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/healthcare.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Manufacturing</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Manufacturing</div>
			<p class="copy">Protecting your factory environments – from traditional devices to state-of-the-art infrastructures</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Oil &amp; Gas</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Oil &amp; Gas</div>
			<p class="copy">ICS/OT Security for the oil and gas utility industry</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Electric Utility</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Electric Utility</div>
			<p class="copy">ICS/OT Security for the electric utility</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for/federal-government.html">Federal</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Federal</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/federal-government.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Automotive</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Automotive</div>
			
			<a class="leaf-button color-d71920" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">5G Networks</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">5G Networks</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/small-business/worry-free-services-suites.html">Small &amp; Midsized Business Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Small &amp; Midsized Business Security</div>
			<p class="copy">Stop threats with comprehensive, set-it-and-forget-it protection</p>
			<a class="leaf-button color-d71920" href="/en_us/small-business/worry-free-services-suites.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Platform</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/one-platform.html">Vision One Platform</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/one-platform.html">Vision One Platform</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Vision One</div>
			<div class="title">Our Unified Platform</div>
			<p class="copy">Bridge threat protection and cyber risk management</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/one-platform.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/technologies/ai-companion.html">AI Companion</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Trend Vision One Companion</div>
			<p class="copy">Your generative AI cybersecurity assistant</p>
			<a class="leaf-button color-d71920" href="/en_us/business/technologies/ai-companion.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/attack-surface-management.html">Attack Surface Management</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Attack Surface Management</div>
			<p class="copy">Stop breaches before they happen</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/attack-surface-management.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR (Extended Detection &amp; Response)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR (Extended Detection &amp; Response)</div>
			<p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud.html">Cloud Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud.html">Cloud Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Vision One™</div>
			<div class="title">Cloud Security Overview</div>
			<p class="copy">The most trusted cloud security platform for developers, security teams, and businesses</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/attack-surface-management.html">Attack Surface Risk Management for Cloud</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Attack Surface Risk Management for Cloud</div>
			<p class="copy">Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/attack-surface-management.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR for Cloud</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR for Cloud</div>
			<p class="copy">Extend visibility to the cloud and streamline SOC investigations</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html">Workload Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Workload Security</div>
			<p class="copy">Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html">Container Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Container Security</div>
			<p class="copy">Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html">File Storage Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">File Storage Security</div>
			<p class="copy">Security for cloud file/object storage services leveraging cloud-native application architectures</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/endpoint-security.html">Endpoint Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/endpoint-security.html">Endpoint Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Endpoint Security Overview</div>
			<p class="copy">Defend the endpoint through every stage of an attack</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR for Endpoint</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR for Endpoint</div>
			<p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/endpoint-security/workload-security.html">Workload Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Workload Security</div>
			<p class="copy">Optimized prevention, detection, and response for endpoints, servers, and cloud workloads</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/endpoint-security/workload-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/iot/industrial-endpoint-security.html">Industrial Endpoint Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Endpoint Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-endpoint-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html">Mobile Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Mobile Security</div>
			<p class="copy">On-premises and cloud protection against malware, malicious applications, and other mobile threats</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/network.html">Network Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network.html">Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Network Security Overview</div>
			<p class="copy">Expand the power of XDR with network detection and response</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR for Network</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR for Network</div>
			<p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/intrusion-prevention.html">Network Intrusion Prevention (IPS)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Network Intrusion Prevention (IPS)</div>
			<p class="copy">Protect against known, unknown, and undisclosed vulnerabilities in your network</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/advanced-threat-protection.html">Breach Detection System (BDS)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Breach Detection System (BDS)</div>
			<p class="copy">Detect and respond to targeted attacks moving inbound, outbound, and laterally</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/advanced-threat-protection.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/zero-trust-secure-access.html">Secure Service Edge (SSE)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Secure Service Edge (SSE)</div>
			<p class="copy">Redefine trust and secure digital transformation with continuous risk assessments</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/zero-trust-secure-access.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html">Industrial Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Network Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">5G Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">5G Network Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/email-security.html">Email Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/email-security.html">Email Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Email Security</div>
			<p class="copy">Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/email-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html">Email and Collaboration Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Vision One™</div>
			<div class="title">Email and Collaboration Security</div>
			<p class="copy">Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">OT Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">OT Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">OT Security</div>
			<p class="copy">Learn about solutions for ICS / OT security.</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR for OT</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR for OT</div>
			<p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html">Industrial Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Network Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html">Industrial Network Security</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security">Industrial Endpoint Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Endpoint Security</div>
			
			<a class="leaf-button color-d71920" href="/content/trendmicro/en_us/business/products/iot/industrial-endpoint-security">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/intrusion-prevention/threat-intelligence.html">Threat Intelligence</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Threat Intelligence</div>
			<p class="copy">Keep ahead of the latest threats and protect your critical data with ongoing threat prevention and analysis</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention/threat-intelligence.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products.html">All Products, Services, and Trials</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">All Products, Services, and Trials</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Research</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about/threat-research.html">Research</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/threat-research.html">Research</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/threat-research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/research.html">Research, News, and Perspectives</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research, News, and Perspectives</div>
			
			<a class="leaf-button color-d71920" href="/en_us/research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Research and Analysis</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research and Analysis</div>
			
			<a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Security News</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Security News</div>
			
			<a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Zero Day Initiatives (ZDI)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Zero Day Initiatives (ZDI)</div>
			
			<a class="leaf-button color-d71920" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Services</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Our Services</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Service Packages</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Service Packages</div>
			<p class="copy">Augment security teams with 24/7/365 managed detection, response, and support</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/managed-xdr.html">Managed XDR</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Managed XDR</div>
			<p class="copy">Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/managed-xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a>
</div>
<ul class="branch nav-item-3">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/incident-response.html">Incident Response</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Incident Response</div>
			<p class="copy">Our trusted experts are on call whether you&#39;re experiencing a breach or looking to proactively improve your IR plans</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/incident-response.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/incident-response/insurance-law.html">Insurance Carriers and Law Firms</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Insurance Carriers and Law Firms</div>
			<p class="copy">Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/incident-response/insurance-law.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/support-services.html">Support Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Support Services</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/support-services.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Partners</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners/channel-partners.html">Partner Program</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners.html">Partner Program</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Program Overview</div>
			<p class="copy">Grow your business and protect your customers with the best-in-class complete, multilayered security</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/managed-security-service-provider.html">Managed Security Service Provider</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Managed Security Service Provider</div>
			<p class="copy">Deliver modern security operations services with our industry-leading XDR</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/managed-security-service-provider.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/managed-service-provider.html">Managed Service Provider</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Managed Service Provider</div>
			<p class="copy">Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/managed-service-provider.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/cloud-service-provider.html">Cloud Service Provider</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Service Provider</div>
			<p class="copy">Add market-leading security to your cloud service offerings – no matter which platform you use</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/cloud-service-provider.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/professional-services-partner.html">Professional Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Professional Services</div>
			<p class="copy">Increase revenue with industry-leading security</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/professional-services-partner.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/resellers.html">Resellers</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Resellers</div>
			<p class="copy">Discover the possibilities</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/resellers.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/marketplace.html">Marketplace</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Marketplace</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/marketplace.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/systems-integrator.html">System Integrators</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">System Integrators</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/systems-integrator.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Alliance Overview</div>
			<p class="copy">We work with the best to help you optimize performance and value</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners/technology.html">Technology Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Technology Alliance Partners</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/technology.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Our Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Our Alliance Partners</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners.html#tools">Partner Tools</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners.html#tools">Partner Tools</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Tools</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners.html#tools">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Partner Login</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Login</div>
			
			<a class="leaf-button color-d71920" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Login</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/support-services/education.html">Education and Certification</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Education and Certification</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/support-services/education.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/partner-stories.html">Partner Successes</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Successes</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/partner-stories.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/distributors.html">Distributors</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Distributors</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/distributors.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Find a Partner</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Find a Partner</div>
			
			<a class="leaf-button color-d71920" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Company</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Why Trend Micro</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/why-trend-micro.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/customer-stories.html">Customer Success Stories</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Customer Success Stories</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/customer-stories.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/human-connections.html">The Human Connection</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">The Human Connection</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/human-connections.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/industry-recognition.html">Industry Accolades</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industry Accolades</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/industry-recognition.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Strategic Alliances</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Strategic Alliances</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/compare.html">Compare Trend Micro</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Compare Trend Micro</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/compare.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about.html">About Us</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about.html">About Us</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">About Us</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/trust-center.html">Trust Center</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Trust Center</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/trust-center.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/history-vision-values.html">History</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">History</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/history-vision-values.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/diversity-inclusion.html">Diversity, Equity and Inclusion</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Diversity, Equity and Inclusion</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/diversity-inclusion.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/corporate-social-responsibility.html">Corporate Social Responsibility</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Corporate Social Responsibility</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/corporate-social-responsibility.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/leaders.html">Leadership</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Leadership</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/leaders.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/leading-experts.html">Security Experts</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Security Experts</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/leading-experts.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/initiative-education.html">Internet Safety and Cybersecurity Education</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Internet Safety and Cybersecurity Education</div>
			
			<a class="leaf-button color-d71920" href="/en_us/initiative-education.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/legal.html">Legal</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Legal</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/legal.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Investors</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Investors</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/campaigns/formula-e.html">Formula E Racing</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Formula E Racing</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/campaigns/formula-e.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Latest News</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Latest News</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Latest News</div>
			
			<a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://newsroom.trendmicro.com/">Newsroom</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Newsroom</div>
			
			<a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/events.html">Events</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Events</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/events.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/careers.html">Careers</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Careers</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/careers.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/webinars.html">Webinars</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Webinars</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/webinars.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	</ul>
</div>

<div class="list-wrapper drop-down-menu-2">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-3">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-4">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-5">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>



<div class="buttonArrayV1">





<ul class="button-array small left-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none">
	<li class="button-array-list">
		
	<a class="button  secondary color-ffffff normal" id="rsg-nav-free-trial-a34d5e" href="/en_us/business/products/trials.html#detection-response">
		Free Trials
	</a>

	</li>

	<li class="button-array-list">
		
	<a class="button  primary color-d71920 normal" id="rsh-nav-contact-us-b93ab0" href="/en_us/business/get-info-form.html">
		Contact Us
	</a>

	</li>
</ul>
</div>
</div>
</div>
			
			<div class="consumerLink">
				<a href="/en_us/forHome.html">Looking for home solutions?</a>
				
			</div>
			<a href="https://resources.trendmicro.com/GLB-Under-Attack-Form.html" class="under-attack-link">Under Attack?</a>
			<div class="alerts">
				<div class="alertUtilityMenu">
					<div class="utility-wrapper alert-top-menu">
						<div class="dropDownMenuV1">
							<div class="label"><span class="counter">6</span> Alerts</div>
							<div class="menu"><!--Intentionally left blank--></div>
						</div>
					</div>
					<div class="utility-wrapper alert-sub-menu">
						<button type="button" class="back-one-level-utility">
							<span>Back</span>
						</button>
						<div class="sub-wrapper-content">
							<div class="alerts-wrapper">
								<div class="alert-buttons">
									<div class="alerts-unread-button is-active">Unread</div>
									<div class="alerts-all-button">All</div>
								</div>
								<div class="sub-alerts-wrapper"></div>
							</div>

							<ul class="alerts-list">
								<li id="alert-297cc1" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										<a href="/en_us/lockbit-ng-dev-prevent.html">
											<p class="copy">Trend helps shield the world from Ransomware Threat Group LockBit</p>
										</a>
										
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									<a href="/en_us/lockbit-ng-dev-prevent.html">
										<p class="ctaText">Learn more &gt;</p>
									</a>
									
								</li>
							
								<li id="alert-7cb866" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										
										<a class="bs-modal" data-modal-title="Webinar: The SmartScreen Vulnerability" id="7cb866" href="https://resources.trendmicro.com/microsoft-defender-smartscreen-vulnerability-webinar.html">
											<p class="copy">Webinar: The SmartScreen Vulnerability</p>
										</a>
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									
									<a class="bs-modal" data-modal-title="Webinar: The SmartScreen Vulnerability" id="7cb866" href="https://resources.trendmicro.com/microsoft-defender-smartscreen-vulnerability-webinar.html">
										<p class="ctaText">In-depth insights and protection strategies  &gt;</p>
									</a>
								</li>
							
								<li id="alert-c99287" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										<a href="/en_us/prevent-smartscreen-vulnerability.html">
											<p class="copy">The Microsoft Defender SmartScreen Vulnerability</p>
										</a>
										
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									<a href="/en_us/prevent-smartscreen-vulnerability.html">
										<p class="ctaText">The facts, and why our customers are safe &gt;</p>
									</a>
									
								</li>
							
								<li id="alert-69dea5" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										<a href="https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/building-resilience-2024-security-predictions-for-the-cloud">
											<p class="copy">2024 Security Predictions for the Cloud</p>
										</a>
										
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									<a href="https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/building-resilience-2024-security-predictions-for-the-cloud">
										<p class="ctaText">Exploring cloud threats in 2024 from data poisoning of machine learning data to securing APIs &gt;</p>
									</a>
									
								</li>
							
								<li id="alert-c2e6e1" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										<a href="/en_us/research/24/b/global-security-trends-2024.html">
											<p class="copy">Global Security Trends: AI, Geopolitical Risks, and Zero Trust</p>
										</a>
										
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									<a href="/en_us/research/24/b/global-security-trends-2024.html">
										<p class="ctaText">Trend Micro&#39;s Chief Technology Strategy Officer explores what to watch for in 2024 &gt;</p>
									</a>
									
								</li>
							
								<li id="alert-0089e1" class="unread">
									<div class="copy-wrapper">
										<!-- TEXT - now clickable -->
										
										<a href="/en_us/research/24/b/generative-ai-cybersecurity-2024.html">
											<p class="copy">Understanding what generative AI means for cybersecurity</p>
										</a>
										
										<span class="material-symbols-outlined">close</span>
									</div>
									<!-- CTA TEXT -->
									
									<a href="/en_us/research/24/b/generative-ai-cybersecurity-2024.html">
										<p class="ctaText">How bad actors can use AI for key fraud opportunities &gt;</p>
									</a>
									
								</li>
							</ul>
						</div>
					</div>
				</div>
			</div>

			<div class="utilityMenuV1"><div class="utilityMenu utilityMenuV1">


<div class="utility-wrapper standard-utility-wrapper">
	<div class="dropDownMenuV1">
		<div class="label">Support</div>
		<div class="menu">


<ul>
	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank">
			Business Support Portal
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/community/s" target="_blank">
			Business Community
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/threat?language=en_US" target="_blank">
			Virus and Threat Help
		</a>
	</li>

	<li>
		<a href="/en_us/business/services/support-services/education.html">
			Education and Certification
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/contactus" target="_blank">
			Contact Support
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank">
			Find a Support Partner
		</a>
	</li>
</ul>
</div>
	</div>

	<div class="dropDownMenuV1">
		<div class="label">Resources</div>
		<div class="menu">


<ul>
	<li>
		<a href="/en_us/security-intelligence/breaking-news/cyber-risk-index.html">
			Cyber Risk Index/Assessment
		</a>
	</li>

	<li>
		<a href="/en_us/ciso.html">
			CISO Resource Center
		</a>
	</li>

	<li>
		<a href="/en_us/devops.html">
			DevOps Resource Center
		</a>
	</li>

	<li>
		<a href="/en_us/what-is.html">
			What Is?
		</a>
	</li>

	<li>
		<a href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/">
			Threat Encyclopedia
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="http://trendmicro.com/public-cloud-risk-assessment" target="_blank">
			Cloud Health Assessment
		</a>
	</li>

	<li>
		<a href="/en_us/business/capabilities/solutions-for/cyber-insurance.html">
			Cyber Insurance
		</a>
	</li>

	<li>
		<a href="https://www.trendmicro.com/vinfo/us/security/definition/a">
			Glossary of Terms
		</a>
	</li>

	<li>
		<a href="/en_us/about/webinars.html">
			Webinars
		</a>
	</li>
</ul>
</div>
	</div>

	<div class="dropDownMenuV1">
		<div class="label">Log In</div>
		<div class="menu">


<ul>
	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank">
			Support
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://community-trendmicro.force.com/Gpartner/s/login/?language=en_US&ec=302&startURL=%2FGpartner%2Fs%2F" target="_blank">
			Partner Portal
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://cloudone.trendmicro.com/" target="_blank">
			Cloud One
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php" target="_blank">
			Product Activation and Management
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t" target="_blank">
			Referral Affililate
		</a>
	</li>
</ul>
</div>
	</div>
</div>
<div class="utility-wrapper active-utility-wrapper">
	<button type="button" class="back-one-level-utility">
		<span>Back</span>
	</button>
	<div class="sub-utility-wrapper"></div>
</div>
</div>
</div>
		</div>
	</nav>
</header>

<div class="search">
	<script type="text/javascript" src="//customer.cludo.com/scripts/bundles/search-script.js"></script>
	
	<script type="text/javascript">
		var cludoSettings = {};

		if( undefined === window.utag_data ) {
			cludoSettings.cludo_language = 'en';
		} else {
			switch (window.utag_data.language_code) {
				// Cludo dropped the ball on this one
				case 'ja_jp':
					cludoSettings.cludo_language = 'jp';
					break;
				case 'in_id':
					cludoSettings.cludo_language = 'id';
					break;
				default:
					cludoSettings.cludo_language = window.utag_data.language_code.substring(0, 2); // First two letters are the language
					break;
			}
		}

		cludoSettings.settingsObject = {
			customerId: 296,
			engineId: 1798,
			searchUrl: "/en_us/common/cse.html",
			searchInputs: ["cludo-search-form","cludo-search-form-mobile","cludo-search-content-form"],
			initSearchBoxText: "",
			language: cludoSettings.cludo_language,
			//endlessScroll: {stopAfterPage:3, resultsPerPage:10, bottomOffset: 145},
			//translateSearchTemplates: true,
			loading: "<div class='loader'></div>"
		};
	</script>

	<span class="material-symbols-outlined search-back-arrow">arrow_back</span>

	<div class="inner-search-wrap">
		<span class="material-symbols-outlined search-icon">search</span>
		<form class="main-menu-search" aria-label="Search Trend Micro">
			<div class="main-menu-search__field-wrapper" id="cludo-search-form">
				<table class="gsc-search-box">
					<tbody>
					<tr>
						<td class="gsc-input">
							<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search"/>
						</td>
					</tr>
					</tbody>
				</table>
			</div>
		</form>
		<span class="material-symbols-outlined search-clear-button">close</span>
	</div>
</div>
</div>
</div>

<section class="folder-indicators slider">
	<div class="folder-indicators__wrapper">
		<p class="folder-indicators__title">Content has been added to your Folio</p>
		<div class="folder-indicators__button-wrapper">
			<button class="folder-indicators__button counter" id="counter-folder">
				Go to Folio (<span>0</span>)
			</button>
			<button class="folder-indicators__button close"><span class="material-symbols-outlined close-folio-message">close</span></button>

		</div>
	</div>
</section></div>
<div class="root responsivegrid">


<div class="aem-Grid aem-Grid--12 aem-Grid--default--12 ">
    
    <div class="articleBodyNoHero aem-GridColumn aem-GridColumn--default--12"><div class="research-layout article container" role="contentinfo">
    <article class="research-layout--wrapper row" data-article-pageID="1286998833">
        <div class="col-xs-12 col-md-12 one-column">
            <div class="col-xs-12 col-md-12">
                <div class="article-details" role="heading">
	<span class="article-details__bar" role="img"></span>
	<p class="article-details__display-tag">Malware</p>
	<h1 class="article-details__title">Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement</h1>
	<p class="article-details__description">While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor&#39;s server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we&#39;ve dubbed SprySOCKS due to its swift behavior and SOCKS implementation.



</p>
	<p class="article-details__author-by">By: Joseph C Chen, Jaromir Horejsi
		
			<time class="article-details__date">September 18, 2023</time>
		
		
		<span>Read time:&nbsp;</span><span class="eta"></span> (<span class="words"></span> words)
	</p>

	<div class="article-details__icons">
		<!--Add This-->
		<!-- Go to www.addthis.com/dashboard to customize your tools -->
<div class="addthis_toolbox addthis_default_style">
	<a class="addthis_button_compact addthis_link">
		<img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg" class="addthis-icon" alt="Share"/>
	</a>
	<a class="addthis_button_print addthis_link">
		<img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg" class="addthis-icon" alt="Print"/>
	</a>
</div>

		<!--Add to Folio-->
		<div class="add-to-folio tooltip">
			<span class="icon-folio-thin"></span>
			<div class="right">
				<p>Save to Folio</p>
				<i></i>
			</div>
		</div>

		<!--Subscribe-->
		<div class="subscribe">
			<a class="bs-modal" href="https://resources.trendmicro.com/subscription-us.html" title="Subscribe" data-modal-title="Subscribe" target="target">
				<span class="icon-subscribe"></span> <span class="text">Subscribe</span>
			</a>
		</div>
	</div>
</div>

            </div>
        </div>
		
		<hr class="research-layout-divider"/>

        <main class="main--content col-xs-12 col-lg-8 col-lg-push-2">
            <div>
	
    


	

</div>
            <div class="richText">
	
    


	
		<div>
			<p>In early 2021, we published a research paper discussing the operation of a China-linked threat actor we tracked as <a href="/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html">Earth Lusca</a>. Since our initial research, the group has remained active and has even extended its operations, targeting countries around the world during the first half of 2023.</p>
<p>While monitoring the group, we managed to obtain an interesting, encrypted file hosted on the threat actor’s delivery server. We were able to find the original loader of the file on VirusTotal and successfully decrypted it. Interestingly, the decrypted payload is a Linux-targeted backdoor that we have never seen before. The main execution routine and its strings show that it originates from the open-source Windows backdoor <a href="https://github.com/RamadhanAmizudin/malware/tree/62d0035db6bc9aa279b7c60250d439825ae65e41/Trochilus">Trochilus</a>, with several functions being re-implemented for Linux systems. We named this new Linux variant SprySOCKS, referring to the swift behaviors of Trochilus and the new Socket Secure (<a href="https://www.computerhope.com/jargon/s/socks.htm">SOCKS</a>) implementation inside the backdoor.</p>
<p>Analysis of the SprySOCKS backdoor reveals some interesting findings. The backdoor contains a marker that refers to the backdoor’s version number. We have identified two SprySOCKS payloads that contain two different version numbers, indicating that the backdoor is still under development. In addition, we noticed that the implementation of the interactive shell is likely inspired from the Linux variant of the <a href="https://www.cyber.airbus.com/newcomers-derusbi-family/">Derusbi malware</a>.</p>
<p>Meanwhile, the structure of SprySOCKS’s command-and-control (C&amp;C) protocol is similar to one used by the <a href="/en_us/research/17/g/chessmaster-cyber-espionage-campaign.html">RedLeaves backdoor</a>, a remote access trojan (RAT) <a href="https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html">reported</a> to be infecting Windows machines. It consists of two components, the loader and the encrypted main payload. The loader is responsible for reading, decrypting, and running the main payload.</p>
<p>Similar to the Windows version, the Linux variant analyzed in this report also consists of these two components. Previously, it was reported that RedLeaves was also built upon the publicly available source code of Trochilus.</p>
<p>So far, we have only observed SprySOCKS used by Earth Lusca. In this blog entry, we will provide more context on Earth Lusca’s use of the malware, together with a thorough analysis of its components and capabilities.</p>
<h1><span class="body-subhead-title">Recent Earth Lusca activity</span></h1>
<p>Earth Lusca remained active during the first half of 2023, with its attacks focusing primarily on countries in Southeast Asia, Central Asia, and the Balkans (with a few scattered attacks on Latin American and African countries). The group’s main targets are government departments that are involved in foreign affairs, technology, and telecommunications.</p>
<p>Earth Lusca is now aggressively targeting the public-facing servers of its victims. Furthermore, we have seen them frequently exploiting server-based N-day vulnerabilities, including (but not limited to) the following:</p>

		</div>
	

</div>
            <div class="image">
	
    


	

</div>
            <div>




    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col">Vulnerability</th>
<th scope="col">Description</th>
</tr><tr><td height="31" width="520"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684">CVE-2022-40684</a></td>
<td width="520">An authentication bypass vulnerability in Fortinet FortiOS, FortiProxy and FortiSwitchManager</td>
</tr><tr><td height="31" width="520"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39952">CVE-2022-39952</a></td>
<td width="520">An unauthenticated remote code execution (RCE) vulnerability in Fortinet FortiNAC</td>
</tr><tr><td height="31" width="520"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22205">CVE-2021-22205</a></td>
<td width="520">An unauthenticated RCE vulnerability in GitLab CE/EE</td>
</tr><tr><td height="31" width="520"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18935">CVE-2019-18935</a></td>
<td width="520">An unauthenticated remote code execution vulnerability in Progress Telerik UI for ASP.NET AJAX</td>
</tr><tr><td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9670">CVE-2019-9670</a> / <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9621">CVE-2019-9621</a></td>
<td>A bundle of two vulnerabilities for unauthenticated RCE in Zimbra Collaboration Suite</td>
</tr><tr><td>ProxyShell (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473">CVE-2021-34473</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34523">CVE-2021-34523</a>v, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31207">CVE-2021-31207</a>)</td>
<td>A set of three chained vulnerabilities that perform unauthenticated RCE in Microsoft Exchange</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 1. The list of vulnerabilities exploited by Earth Lusca</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Earth Lusca takes advantage of server vulnerabilities to infiltrate its victim’s networks, after which it will deploy a web shell and install <a href="/en_us/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html">Cobalt Strike</a> for lateral movement. The group intends to exfiltrate documents and email account credentials, as well as to further deploy advanced backdoors like ShadowPad and the Linux version of Winnti to conduct long-term espionage activities against its targets.</p>
<h1><span class="body-subhead-title">The “mandibule” loader component</span></h1>
<p>At the beginning of our investigation, we observed a file named <i>libmonitor.so.2</i> hosted on Earth Lusca’s delivery server. Without previous context, this seemed to be a binary file containing only random bytes, indicating that it is likely an encrypted payload. We used the unique file name to perform a search on VirusTotal that allowed us to identify a related ELF file (<i>SHA256: 65b27e84d9f22b41949e42e8c0b1e4b88c75211cbf94d5fd66edc4ebe21b7359</i>) named “mkmon”. The ELF file could be used to decrypt the <i>libmonitor.so.2</i> file and recover its original payload, proving that “mkmon”<i> </i>is the loader bundled with <i>libmonitor.so.2</i>.</p>
<p>The loader was not developed from scratch — its developer used a publicly available Linux ELF injector called “<a href="https://github.com/ixty/mandibule">mandibule</a>”<i> </i>(the French word for <a href="https://en.wikipedia.org/wiki/Mandible">mandible</a>, or lower jaw). The original ELF injector project is a command-line tool with the ability to inject a payload into itself (self-injection) or into another project. As a typical command-line tool, it prints usage text that lists supported parameters. The original injector also prints various debug messages to inform the user about the progress of the injection.</p>
<p>The threat actor used the mandibule project as a basis for its malware loader. The project creator removed the usage screen and the ability to inject to other processes, and then added a function to load and decrypt the second stage. We consider this job to be sloppily done since the developer did not bother to remove debug messages, and the loader was not stripped (that is, it was distributed with debug symbols). Indeed, the threat actor seemed to put minimum effort into modifying the original injector just to be able to make it load the payload.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="dac428" href="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-1.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-1.png" alt="Figure 1. The loader distributed with debug information; note that the “.debug_*” sections are present"/>
		</a>
		<div class="caption-image-container ">
			<figcaption>Figure 1. The loader distributed with debug information; note that the “.debug_*” sections are present</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="9b4fa3" href="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-2.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-2.png" alt="Figure 2. The debug messages displayed when running the loader"/>
		</a>
		<div class="caption-image-container ">
			<figcaption>Figure 2. The debug messages displayed when running the loader</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The debug messages displayed in Figure 2 have two distinct markers. The “&gt;” marker is from the original<i> </i>mandibule project, while the “[+]” or “[-]” markers are debug messages added to the loader by the threat actor.</p>
<p>The name of the loader’s process is set to “kworker/0:22” by the <i><a href="https://man7.org/linux/man-pages/man2/prctl.2.html">prctl</a></i> command. Normally, <a href="https://askubuntu.com/questions/33640/kworker-what-is-it-and-why-is-it-hogging-so-much-cpu">kworker</a> is a placeholder process for kernel worker threads. In this scenario, however, the “kworker”<i> </i>name has nothing to do with kernel worker threads. Instead, the loader abuses this name just to avoid suspicion when the user lists all running tasks via commands such as <i><a href="https://man7.org/linux/man-pages/man1/ps.1.html">ps</a></i> or <i><a href="https://man7.org/linux/man-pages/man1/top.1.html">top</a></i>.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-3.png" alt="Figure 3. The name of the process is set to “kworker/0:22”"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 3. The name of the process is set to “kworker/0:22”</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-4.png" alt="Figure 4. The list of “kworker*” processes on an infected machine; the highlighted process is the analyzed loader"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 4. The list of “kworker*” processes on an infected machine; the highlighted process is the analyzed loader</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The loader accepts two command-line parameters: the path to the encrypted second stage file and the self-delete flag. The second stage is encrypted with an AES-ECB cipher, with the password being hard-coded in the loader.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-5.png" alt="Figure 5. Function to decrypt the second stage"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 5. Function to decrypt the second stage</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The loader is also responsible for setting the persistence. It copies itself and the encrypted second stage to the <i><a href="http://www.linfo.org/usr_bin.html">/usr/sbin/</a></i> directory (see debug notes “[+] rename loader ok” and “[+] rename server ok”). It then uses <i><a href="https://linux.die.net/man/8/chkconfig">chkconfig</a></i> or <i><a href="https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/">systemd</a> </i>to start the loader as a service. If the self-delete flag is set to “1”, then the originally executed loader and the encrypted stage files are both deleted.</p>
<h1><span class="body-subhead-title">The SprySOCKS component</span></h1>
<p>While examining the decrypted second stage, visible strings revealed that it was statically compiled with <a href="https://github.com/ldcsaa/HP-Socket">HP-Socket</a> project, a high-performance network framework of Chinese origin.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-6.png" alt="Figure 6. HP-Socket references among visible strings"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 6. HP-Socket references among visible strings</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Initialization procedure reveals a hard-coded AES-ECB password used for encrypting communication with the C&amp;C server.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-7.png" alt="Figure 7. AES password used for C&amp;C communication"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 7. AES password used for C&amp;C communication</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The C&amp;C address and port are also hard-coded in the module, but they are not encrypted and are visible in plain text.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-8.png" alt="Figure 8. C&amp;C server and port configuration"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 8. C&amp;C server and port configuration</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>C&amp;C communication consists of packets sent via TCP (Transmission Control Protocol). The packet has a header consisting of <i>0x12</i> bytes, followed by a base64-encoded, AES-ECB-encrypted message. Similar to Table B-2 in this <a href="https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html">previous analysis</a> of the RedLeaves malware, the header contains some random and hard-coded values, plus the length of the payload (highlighted in blue in Figure 9).</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-9.png" alt="Figure 9. Example of a packet sent from the victim’s machine to the C&amp;C server"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 9. Example of a packet sent from the victim’s machine to the C&amp;C server</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-10.png" alt="Figure 10. Fixed value of 0xACACBCBC; occurs in sent packets at offsets 4 – 7"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 10. Fixed value of 0xACACBCBC; occurs in sent packets at offsets 4 – 7</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The fixed value used in the original Trochilus is <i>0xAFAFBFBF</i>, while in the RedLeaves variant it is <i>0xBFD9CBAE</i>.<br />
<br />
After decoding and decrypting the message, it reveals keywords such as “__handler”, “__msgid”, “__serial”, and “clientid”. Some of these keywords can be found in <a href="https://github.com/RamadhanAmizudin/malware/blob/62d0035db6bc9aa279b7c60250d439825ae65e41/Trochilus/common/CommData.cpp#L4">Trochilus</a>, but more importantly, these messages closely resemble the <a href="https://github.com/nccgroup/Cyber-Defence/blob/37e21a332e65bbe2068c930787f527d4dbbdcd98/Technical%20Notes/Red%20Leaves/Source/Red%20Leaves%20technical%20note%20v1.0.md?plain=1#L205">RedLeaves</a> communication protocol. </p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-11.png" alt="Figure 11. Decoded and AES-ECB-decrypted message"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 11. Decoded and AES-ECB-decrypted message</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The RAT implements several standard backdoor commands, including the collecting system information, starting an interactive shell, listing network connections, creating SOCKS proxy, uploading and downloading files, and other basic file operations (listing, deleting, renaming, and creating a directory). Table 2 shows message IDs and the approximate descriptions of what functions the messages are related to.</p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Message ID</th>
<th scope="col" style="text-align: center;">Notes</th>
</tr><tr><td height="31" width="520" style="text-align: center;">0x09</td>
<td width="520" style="text-align: center;">Gets machine information</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x0a</td>
<td width="520" style="text-align: center;">Starts interactive shell</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x0b</td>
<td width="520" style="text-align: center;">Writes data to interactive shell</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x0d</td>
<td width="520" style="text-align: center;">Stops interactive shell</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x0e</td>
<td width="520" style="text-align: center;">Lists network connections (parameters: “ip”, “port”, “commName”, “connectType”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x0f</td>
<td width="520" style="text-align: center;">Sends packet (parameter: “target”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x14, 0x19</td>
<td width="520" style="text-align: center;">Sends initialization packet</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x16</td>
<td width="520" style="text-align: center;">Generates and sets clientid</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x17</td>
<td width="520" style="text-align: center;">Lists network connections (parameters: “tcp_port”, “udp_port”, “http_port”, “listen_type”, “listen_port”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x23</td>
<td width="520" style="text-align: center;">Creates SOCKS proxy</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x24</td>
<td width="520" style="text-align: center;">Terminates SOCKS proxy</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x25</td>
<td width="520" style="text-align: center;">Forwards SOCKS proxy data</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x2a</td>
<td width="520" style="text-align: center;">Uploads file (parameters: “transfer_id”, “size”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x2b</td>
<td width="520" style="text-align: center;">Gets file transfer ID</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x2c</td>
<td width="520" style="text-align: center;">Downloads file (parameters: “state”, “transferId”, “packageId”, “packageCount”, “file_size”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x2d</td>
<td width="520" style="text-align: center;">Gets transfer status (parameters: “state”, “transferId”, “result”, “packageId”)</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x3c</td>
<td width="520" style="text-align: center;">Enumerates files in root /</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x3d</td>
<td width="520" style="text-align: center;">Enumerates files in directory</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x3e</td>
<td width="520" style="text-align: center;">Deletes file</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x3f</td>
<td width="520" style="text-align: center;">Creates directory</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x40</td>
<td width="520" style="text-align: center;">Renames file</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x41</td>
<td width="520" style="text-align: center;">No operation</td>
</tr><tr><td height="31" width="520" style="text-align: center;">0x42</td>
<td width="520" style="text-align: center;">Is related to operations 0x3c – 0x40 (srcPath, destPath)</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 2. List of handled messages and an explanation of their functions</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h2><span class="body-subhead-title"><span class="rte-sub-menu-text">Get machine information (CollectInfo)</span></span></h2>
<p>The client information structure resembles the original <a href="https://github.com/RamadhanAmizudin/malware/blob/62d0035db6bc9aa279b7c60250d439825ae65e41/Trochilus/server/master/master/ClientInfoCallbacks.h">CLIENT_INFO structure</a> used by Trochilus, with some parameters being the same for both Trochilus and the malware we were analyzing. It is also worth noting the parameter “cpufrep”, which is likely a typo of “cpufreq”<i> </i>(CPU frequency).</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-12.png" alt="Figure 12. CLIENT_INFO structure in “ClientInfoCallbacks.h,” which is the Trochilus RAT"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 12. CLIENT_INFO structure in “ClientInfoCallbacks.h,” which is the Trochilus RAT</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Further down in <i><a href="https://github.com/RamadhanAmizudin/malware/blob/62d0035db6bc9aa279b7c60250d439825ae65e41/Trochilus/server/master/master/ClientInfoManager.cpp">ClientInfoManager.cpp</a></i>, the Trochilus RAT, you can see the internal names of the parameters from the CLIENT_INFO structure. Note that most of them have the same values as the listed parameters in Table 2. Furthermore, “cn”, “ip”, “groups”, “vercode”, “priv”, “lang”, “mem”, “os”, “x64”, and “cpufrep” are the same. </p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-13.png" alt="Figure 13. The internal names of CLIENT_INFO parameters, as defined in ClientInfoManager.cpp, the Trochilus RAT"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 13. The internal names of CLIENT_INFO parameters, as defined in ClientInfoManager.cpp, the Trochilus RAT</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Parameter</th>
<th scope="col" style="text-align: center;">Command</th>
<th scope="col" style="text-align: center;">Notes</th>
</tr><tr><td height="31" width="520" style="text-align: center;">cn</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/gethostname.2.html">gethostname</a></td>
<td width="520" style="text-align: center;">Computer name</td>
</tr><tr><td height="31" width="520" style="text-align: center;">systemType</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/uname.2.html">uname; cat /etc/issue; cat /etc/redhat-release</a></td>
<td width="520" style="text-align: center;"> </td>
</tr><tr><td height="31" width="520" style="text-align: center;">systemVersion</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/uname.2.html">uname; cat /etc/issue; cat /etc/redhat-release</a></td>
<td width="520" style="text-align: center;"> </td>
</tr><tr><td height="31" width="520" style="text-align: center;">os</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/uname.2.html">uname; cat /etc/issue; cat /etc/redhat-release</a></td>
<td width="520" style="text-align: center;"> </td>
</tr><tr><td height="31" width="520" style="text-align: center;">mem</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/sysinfo.2.html">sysinfo; totalram</a></td>
<td width="520" style="text-align: center;">Total RAM in MiB</td>
</tr><tr><td height="31" width="520" style="text-align: center;">vercode</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/uname.2.html">uname; cat /etc/issue; cat /etc/redhat-release</a></td>
<td width="520" style="text-align: center;">OS version number</td>
</tr><tr><td height="31" width="520" style="text-align: center;">x64</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/uname.2.html">uname; cat /etc/issue; cat /etc/redhat-release</a></td>
<td width="520" style="text-align: center;">Determines whether the OS is 64-bit</td>
</tr><tr><td height="31" width="520" style="text-align: center;">ip</td>
<td width="520" style="text-align: center;">getifaddrs</td>
<td width="520" style="text-align: center;">IP addresses except for localhost</td>
</tr><tr><td height="31" width="520" style="text-align: center;">groups</td>
<td width="520" style="text-align: center;">getuid</td>
<td width="520" style="text-align: center;">Group name</td>
</tr><tr><td height="31" width="520" style="text-align: center;">priv</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man3/getpwnam.3.html">getpwuid; pw_name</a></td>
<td width="520" style="text-align: center;">Privilege/Username</td>
</tr><tr><td height="31" width="520" style="text-align: center;">lang</td>
<td width="520" style="text-align: center;">echo $LANG</td>
<td width="520" style="text-align: center;">Language</td>
</tr><tr><td height="31" width="520" style="text-align: center;">languageStr</td>
<td width="520" style="text-align: center;"> </td>
<td width="520" style="text-align: center;">Language</td>
</tr><tr><td height="31" width="520" style="text-align: center;">cpunum</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man3/get_nprocs_conf.3.html">get_nprocs_conf</a></td>
<td width="520" style="text-align: center;">Number of processors</td>
</tr><tr><td height="31" width="520" style="text-align: center;">cpufrep (sic!)</td>
<td width="520" style="text-align: center;">cat /proc/cpuinfo|grep cpu\\ MHz|sed -e ‘s/.*:[^0-9]//’</td>
<td width="520" style="text-align: center;">CPU frequency</td>
</tr><tr><td height="31" width="520" style="text-align: center;">mods</td>
<td width="520" style="text-align: center;">No value</td>
<td width="520" style="text-align: center;">Installed modules according to the comment on the Trochilus source code</td>
</tr><tr><td height="31" width="520" style="text-align: center;">save_screen_dir</td>
<td width="520" style="text-align: center;">Constant value</td>
<td width="520" style="text-align: center;">1</td>
</tr><tr><td height="31" width="520" style="text-align: center;">reportTime</td>
<td width="520" style="text-align: center;"><a href="https://man7.org/linux/man-pages/man2/time.2.html">time</a></td>
<td width="520" style="text-align: center;">Current time</td>
</tr><tr><td height="31" width="520" style="text-align: center;">versionType</td>
<td width="520" style="text-align: center;">Constant value, refer as backdoor type “Linux”</td>
<td width="520" style="text-align: center;">LIN</td>
</tr><tr><td height="31" width="520" style="text-align: center;">versionNumber</td>
<td width="520" style="text-align: center;">Constant value, refer as backdoor version</td>
<td width="520" style="text-align: center;">1.3.6</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 3. List of fields in the CLIENT_INFO structure of SprySOCKS</h5>
<h2><span class="body-subhead-title"><span class="rte-sub-menu-text">Interactive shell</span></span></h2>
<p>When a client is requested to create an interactive terminal, it first interacts with the master endpoint for the pseudo-terminal (PTY) subsystem (<a href="https://linux.die.net/man/4/ptmx"><i>/dev/ptmx</i></a>). Afterward, a new slave PTY is created with a unique device node name in the <a href="https://linux.die.net/man/4/ptmx"><i>/dev/pts</i></a> directory.</p>
<p>After this, an <a href="https://man7.org/linux/man-pages/man2/execve.2.html"><i>execve</i></a> command is launched with the parameter “[diskio]”, environment variables instructing it not to save session history (<i style="">HISTFILE=/dev/null</i>), and prompt string (<i style="">PS1</i>) containing current username (u), host name of machine (h), and working directory, which is (w) - (PS1=\\u@\\h:\\w \\$).</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		
			<img src="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/sprysocks-14.png" alt="Figure 14. Creation of the interactive shell"/>
		
		<div class="caption-image-container ">
			<figcaption>Figure 14. Creation of the interactive shell</figcaption>
			
		</div>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>When searching for the aforementioned strings, it’s possible to find a reference to YARA rules matching the Linux version of <a href="https://www.cyber.airbus.com/newcomers-derusbi-family/">Derusbi</a>. It is likely that the threat actor gained inspiration from the techniques used by other pieces of malware or possibly even had direct access to the Derusbi source code itself.</p>
<h2><span class="body-subhead-title"><span class="rte-sub-menu-text">Client ID generator</span></span></h2>
<p>The environment ID (client ID) consists of two components. The first part is the MAC address of the first listed interface (the malware gets the first listed interface, but if this interface is &quot;loopback interface&quot;, then this interface is skipped and the next interface is considered) with a length of 6 bytes; this, when converted to a hexadecimal string, has a length 12 bytes. The second part corresponds to processor features, returned by the <a href="https://wiki.osdev.org/CPUID">CPUID instruction</a> called with the “CPUID_GETFEATURES” parameter. The length of the result is 8 bytes; when converted to a hexadecimal string, this has a length of 16 bytes. Thus, the generated client ID has 14 bytes, and after its conversion to a hexadecimal string, it has 28 bytes.</p>
<h1><span class="body-subhead-title">Attribution</span></h1>
<p>We observed the encrypted SprySOCKS payload hosted on the delivery server <i>207[.]148[.]75[.]122</i> in early June 2023. The server, which was operated by the Earth Lusca threat actor, also delivered  executable files of Cobalt Strike and the Linux version of Winnti to its targets.</p>
<p>The SprySOCKS payload contains a version number (1.3.6) and the C&amp;C domain  <i>lt76ux[.]confenos[.]shop</i>. We found another SprySOCKS payload uploaded by other users on VirusTotal with a version number of 1.1 and which connected to the C&amp;C domain <i>2e6veme8xs[.]bmssystemg188[.]us</i>. It’s worth noting that the sibling domain <i>rvxzn49eghqj[.]bmssystemg188[.]us</i> resolved to <i>38[.]60[.]199[.]208</i>, which overlapped with <i>793tggz7mw91[.]itcom666[.]live</i>. The domain <i>itcom666[.]live</i> is a known C&amp;C domain <a href="https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf">attributed</a> to Earth Lusca.</p>
<h1><span class="body-subhead-title">Conclusion</span></h1>
<p>In this report, we discussed the new backdoor SprySOCKS used by Earth Lusca, which expands the group’s Linux arsenal. Recently, the threat actor has been highly aggressive in targeting the public-facing servers of its victims by exploiting known vulnerabilities.</p>
<p>It is important that organizations proactively manage their attack surface, minimizing the potential entry points into their system and reducing the likelihood of a successful breach. Businesses should regularly apply patches and update their tools, software, and systems to ensure their security, functionality, and overall performance.</p>
<p>Cutting-edge and adaptable security solutions like <a href="https://www.trendmicro.com/en_ph/business/products/detection-response/xdr.html">Trend Micro XDR</a> play a pivotal role in safeguarding organizations against Earth Lusca and other threat actors. These technologies excel at gathering and connecting activity data across various channels, from emails and endpoints to servers, cloud workloads, and networks. This comprehensive approach empowers organizations with a high level of security detection and investigation capabilities, setting it apart from conventional security solutions.</p>
<p><span class="body-subhead-title">Indicators of Compromise (IOCs)</span></p>
<p>The indicators of compromise for this entry can be found <a href="/content/dam/trendmicro/global/en/research/23/i/earth-lusca-employs-new-linux-backdoor/ioc-earth-lusca-employs-new-linux-backdoor.txt">here</a>.</p>

		</div>
	

</div>


</div>
            <section class="tag--list">
	<div class="tag--list-title">Tags</div>
	<div class="tag--list-tags">
		<a href="/en_us/research.html?category=trend-micro-research:threats/malware" class="tag--list-anchor">Malware</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:threats/apt-and-targeted-attacks" class="tag--list-anchor">APT &amp; Targeted Attacks</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:article-type/research" class="tag--list-anchor">Research</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:medium/article" class="tag--list-anchor">Articles, News, Reports</a>
		
	</div>
</section>

        </main>

        <sidebar class="sidebar--left col-xs-12 col-lg-2 col-lg-pull-8">
            


<h3 class="article-authors__title">
	
		Authors
	
</h3>

<!-- /* Show Trend Micro if we don't have any authors for this article */ -->


<ul class="article-authors__list">
	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Joseph C Chen</p>
			
			<p class="article-authors__list-items__position">Threat Researcher</p>
		</div>
	</li>

	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Jaromir Horejsi</p>
			
			<p class="article-authors__list-items__position">Threat Researcher</p>
		</div>
	</li>
</ul>

<div class="article-authors__btn-wrapper" role="button">
	<a class="article-authors__button " href="mailto:tm_research@trendmicro.com" target="target" id="article-authors-contact-us-button">
		Contact Us
	</a>
</div>

<div class="article-authors__btn-wrapper subscribe-wrapper" role="button">
	<a class="article-authors__button subscribe bs-modal" href="https://resources.trendmicro.com/subscription-us.html" data-modal-title="Subscribe" target="target">
		Subscribe
	</a>
</div>
	

    

        </sidebar>

        <sidebar class="sidebar--right col-xs-12 col-lg-2">
            <div class="sidebar--wrapper" role="contentinfo sidebar">
                <div class="row-1" role="contentinfo related articles">
                    
	
    


	<div class="related--articles" role="contentinfo related articles">
		<h3 class="related--articles-title">Related Articles</h3>
		 <ul class="related--articles-items">
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version.html">
					LockBit Attempts to Stay Afloat With a New Version
				</a> 
			</li>
		
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/24/b/earth-preta-campaign-targets-asia-doplugs.html">
					Earth Preta Campaign Uses DOPLUGS to Target Asia
				</a> 
			</li>
		
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/24/b/sans-2023-soc-report.html">
					Exploring Changing SOC Landscapes
				</a> 
			</li>
		</ul>
	</div>

	<div class="archived--link">
		<div class="archived--link-text">
			<a href="/en_us/research.html">
				See all articles
			</a>
		</div>

		<div class="archived--link-icon">
			<a href="/en_us/research.html">
				<span class="icon-chevron-right"></span>
			</a>
		</div>
	</div>


                </div>
            </div>
        </sidebar>
    </article>
</div></div>

    
</div>
</div>
<div class="footer">




<div class="containerV1"><div class="footer_wrapper footer-wrapper"><div class="containerV1">
	<div class="container-content">
		
		<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-441abf9a-d4a7-4e8b-abfe-b78a5f911315">
	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">


	<div class="createAccount">
	<div class="containerV1 section">





<style>
@media ( min-width: 1024px ){
	#containereb774de0-237e-4b84-a2ad-ed9c8722afba,
	.containereb774de0-237e-4b84-a2ad-ed9c8722afba {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}

@media ( max-width: 1023px ) and ( min-width: 768px ){
	#containereb774de0-237e-4b84-a2ad-ed9c8722afba,
	.containereb774de0-237e-4b84-a2ad-ed9c8722afba {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}

@media ( max-width: 767px ){
	#containereb774de0-237e-4b84-a2ad-ed9c8722afba,
	.containereb774de0-237e-4b84-a2ad-ed9c8722afba {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}
</style>


<div id="containereb774de0-237e-4b84-a2ad-ed9c8722afba" class="containereb774de0-237e-4b84-a2ad-ed9c8722afba container-wrap  gray-border global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none rounded-corners-all-20 ">
	

	<section>
		<div class="container-content">
			<div class="prod-content"><div class="text primary-color-white section">
<div id="text-db3f030b20" class="cmp-text">
    <p>Try our services free for 30 days</p>

</div>

    

</div>
<div class="buttonArrayV1 section">





<ul class="button-array small center-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none">
	<li class="button-array-list">
		
	<a class="button  primary color-ffffff normal" id="footer-free-trial-f1f976" href="/en_us/business/products/trials.html#detection-response">
		Start your free trial today
	</a>

	</li>
</ul>
</div>

</div>
		</div>
	</section>
</div>
</div>
<div class="footer section">




	

<ul class="social-media-links">
	
	<li>
		<a href="https://www.linkedin.com/company/trend-micro/" class="social-icon linkedin" target="_blank" rel="noopener noreferrer">
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="LinkedIn" d="M8.8,10.3a1.5,1.5,0,0,1,1.5-1.5H25.295A1.5,1.5,0,0,1,26.8,10.3V25.294A1.5,1.5,0,0,1,25.3,26.8H10.3a1.5,1.5,0,0,1-1.5-1.5Zm7.125,5.359h2.437v1.224a2.793,2.793,0,0,1,2.6-1.337c2.593,0,3.207,1.4,3.207,3.973v4.763H21.55V20.109c0-1.465-.352-2.291-1.245-2.291-1.24,0-1.755.891-1.755,2.291v4.178H15.925Zm-4.5,8.512H14.05V15.55H11.425v8.624Zm3-11.437a1.688,1.688,0,1,1-.507-1.17A1.689,1.689,0,0,1,14.425,12.737Z" transform="translate(-8.8 -8.8)" fill="#020607" fill-rule="evenodd"/>
				</svg>

			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.facebook.com/TrendMicro/" class="social-icon facebook" target="_blank" rel="noopener noreferrer">
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="Facebook" d="M56.087,8.8A3.28,3.28,0,0,0,52.8,12.087V23.513A3.28,3.28,0,0,0,56.087,26.8H62.28V19.763H60.419V17.229H62.28V15.065c0-1.7,1.1-3.262,3.632-3.262a15.371,15.371,0,0,1,1.784.1l-.06,2.366s-.773-.007-1.617-.007c-.913,0-1.06.421-1.06,1.119v1.85h2.75l-.12,2.533h-2.63V26.8h2.554A3.28,3.28,0,0,0,70.8,23.513V12.087A3.28,3.28,0,0,0,67.513,8.8H56.087Z" transform="translate(-52.8 -8.8)" fill="#020607"/>
				</svg>
			
			
			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://twitter.com/trendmicro" class="social-icon twitter" target="_blank" rel="noopener noreferrer">
			
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="20" height="16" viewBox="0 0 20 16">
					<path id="Twitter" d="M116,11.5a8.307,8.307,0,0,1-2.356.635,4.055,4.055,0,0,0,1.8-2.235,8.271,8.271,0,0,1-2.6.979,4.154,4.154,0,0,0-4.934-.8,4.064,4.064,0,0,0-1.8,1.9,3.981,3.981,0,0,0-.256,2.586,11.806,11.806,0,0,1-4.685-1.225,11.625,11.625,0,0,1-3.772-2.995,3.991,3.991,0,0,0-.071,3.936,4.063,4.063,0,0,0,1.341,1.456,4.142,4.142,0,0,1-1.858-.505v.052a4,4,0,0,0,.928,2.558,4.117,4.117,0,0,0,2.364,1.4,4.2,4.2,0,0,1-1.853.069,4.042,4.042,0,0,0,1.46,2.007,4.15,4.15,0,0,0,2.374.8,8.321,8.321,0,0,1-5.1,1.729A8.491,8.491,0,0,1,96,23.785a11.741,11.741,0,0,0,6.289,1.814,11.5,11.5,0,0,0,11.676-11.489c0-.173-.005-.349-.012-.522A8.284,8.284,0,0,0,116,11.5Z" transform="translate(-96 -9.6)" fill="#020607"/>
				</svg>

			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.instagram.com/trendmicro/" class="social-icon instagram" target="_blank" rel="noopener noreferrer">
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="Instagram" d="M146.09,8.854c.959-.044,1.265-.054,3.71-.054s2.751.011,3.71.054a6.631,6.631,0,0,1,2.186.418,4.607,4.607,0,0,1,2.631,2.632,6.641,6.641,0,0,1,.419,2.184c.044.961.054,1.267.054,3.711s-.011,2.751-.054,3.711a6.61,6.61,0,0,1-.419,2.184,4.6,4.6,0,0,1-2.631,2.632,6.626,6.626,0,0,1-2.185.419c-.96.044-1.266.054-3.711.054s-2.751-.011-3.71-.054a6.6,6.6,0,0,1-2.185-.419,4.595,4.595,0,0,1-2.633-2.631,6.643,6.643,0,0,1-.419-2.185c-.044-.961-.054-1.267-.054-3.711s.01-2.751.054-3.71a6.611,6.611,0,0,1,.419-2.186A4.611,4.611,0,0,1,143.9,9.272a6.65,6.65,0,0,1,2.185-.418Zm7.346,1.62c-.949-.043-1.234-.052-3.636-.052s-2.687.009-3.636.052a4.976,4.976,0,0,0-1.673.31,2.972,2.972,0,0,0-1.708,1.708,4.968,4.968,0,0,0-.31,1.671c-.044.949-.053,1.234-.053,3.637s.009,2.688.053,3.637a4.968,4.968,0,0,0,.31,1.671,2.972,2.972,0,0,0,1.708,1.708,4.976,4.976,0,0,0,1.673.31c.949.043,1.232.052,3.636.052s2.688-.009,3.636-.052a4.976,4.976,0,0,0,1.673-.31,2.972,2.972,0,0,0,1.708-1.708,4.968,4.968,0,0,0,.31-1.671c.043-.949.053-1.234.053-3.637s-.01-2.688-.053-3.637a4.968,4.968,0,0,0-.31-1.671,2.972,2.972,0,0,0-1.708-1.708A4.976,4.976,0,0,0,153.436,10.474Zm-4.786,10.1a3,3,0,1,0-1.075-.758A3,3,0,0,0,148.65,20.574Zm-2.121-6.046a4.626,4.626,0,1,1-1.355,3.271A4.634,4.634,0,0,1,146.529,14.529Zm8.924-.666a1.091,1.091,0,0,0,.25-.355,1.1,1.1,0,0,0,.093-.425,1.093,1.093,0,1,0-.343.78Z" transform="translate(-140.8 -8.8)" fill="#020607" fill-rule="evenodd"/>
				</svg>
			
			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.youtube.com/user/TrendMicroInc" class="social-icon youtube" target="_blank" rel="noopener noreferrer">
			
			
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="24.003" height="16.01" viewBox="0 0 24.003 16.01">
					<path id="YouTube" d="M205.9,12.112a2.78,2.78,0,0,0-.765-1.27A3.052,3.052,0,0,0,203.8,10.1c-1.877-.495-9.4-.495-9.4-.495a76.616,76.616,0,0,0-9.39.47,3.156,3.156,0,0,0-1.339.76,2.9,2.9,0,0,0-.777,1.276A29.133,29.133,0,0,0,182.4,17.6a29.058,29.058,0,0,0,.489,5.494,2.818,2.818,0,0,0,.775,1.269,3.094,3.094,0,0,0,1.341.743c1.9.494,9.39.494,9.39.494a76.8,76.8,0,0,0,9.4-.47,3.051,3.051,0,0,0,1.339-.742,2.785,2.785,0,0,0,.765-1.27,28.339,28.339,0,0,0,.5-5.495,26.534,26.534,0,0,0-.5-5.517ZM192,21.029V14.182l6.26,3.424Z" transform="translate(-182.4 -9.6)" fill="#020607"/>
				</svg>

			
		</a>
	</li>
	
</ul>


</div>


</div>




</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-8 column"><div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-c62a5526-e64d-4166-b3b5-f64611f3de82">
	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>Resources</h3>
	
		<ul>
			
				<li><a href="/en_us/research.html" target="_self" rel="noopener noreferrer">Blog</a></li>
			
				<li><a href="https://trendmicro.com/newsroom" target="_self" rel="noopener noreferrer">Newsroom</a></li>
			
				<li><a href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports" target="_self" rel="noopener noreferrer">Threat Reports</a></li>
			
				<li><a href="/en_us/devops.html" target="_self" rel="noopener noreferrer">DevOps Resource Center</a></li>
			
				<li><a href="/en_us/ciso.html" target="_self" rel="noopener noreferrer">CISO Resource Center</a></li>
			
				<li><a href="https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US" target="_blank" rel="noopener noreferrer">Find a Partner</a></li>
			
		</ul>
	
</div>






</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>Support</h3>
	
		<ul>
			
				<li><a href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank" rel="noopener noreferrer">Business Support Portal</a></li>
			
				<li><a href="/en_us/business/get-info-form.html" target="_self" rel="noopener noreferrer">Contact Us</a></li>
			
				<li><a href="/en_us/business/products/downloads.html" target="_self" rel="noopener noreferrer">Downloads</a></li>
			
				<li><a href="/en_us/business/products/trials.html" target="_self" rel="noopener noreferrer">Free Trials</a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
		</ul>
	
</div>






</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>About Trend</h3>
	
		<ul>
			
				<li><a href="/en_us/about.html" target="_self" rel="noopener noreferrer">About Us</a></li>
			
				<li><a href="/en_us/about/careers.html" target="_self" rel="noopener noreferrer">Careers</a></li>
			
				<li><a href="/en_us/contact.html" target="_self" rel="noopener noreferrer">Locations</a></li>
			
				<li><a href="/en_us/about/events.html" target="_self" rel="noopener noreferrer">Upcoming Events</a></li>
			
				<li><a href="/en_us/about/trust-center.html" target="_self" rel="noopener noreferrer">Trust Center</a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
		</ul>
	
</div>






</div>

</div>
</div>
</div>

</div>
</div>
</div>
<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-1f9d3913-6840-478a-8aae-75b6f3d6cdeb">
	<div class="col-sm-12 col-xs-12 col-md-3 column"><div class="footer section">



	
<div class="country-selection">
	<p>Select a country / region</p>
	<div class="dropup position-unset">
		<button class="btn btn-default dropdown-toggle" type="button" id="countryMenu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
			<span class="stateSelect"></span>
			<span class="material-symbols-outlined">
			expand_more</span>
		</button>
		<div class="row dropdown-menu" aria-labelledby="countryMenu">
			<span class="material-symbols-outlined icon-close">close</span>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-2">
					<h4>The Americas</h4>
					<ul>
						
							<li>
								<a href="/en_us.html">United States</a>
							</li>
						
							<li>
								<a href="/pt_br.html">Brasil</a>
							</li>
						
							<li>
								<a href="/en_ca.html">Canada</a>
							</li>
						
							<li>
								<a href="/es_mx.html">México</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-2">
					<h4>Middle East &amp; Africa</h4>
					<ul>
						
							<li>
								<a href="/en_za.html">South Africa</a>
							</li>
						
							<li>
								<a href="/en_ae.html">Middle East and North Africa</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-4">
					<h4>Europe</h4>
					<ul>
						
							<li>
								<a href="/en_be.html">België (Belgium)</a>
							</li>
						
							<li>
								<a href="http://www.trendmicro.cz/">Česká Republika</a>
							</li>
						
							<li>
								<a href="/en_dk.html">Danmark</a>
							</li>
						
							<li>
								<a href="/de_de.html">Deutschland, Österreich Schweiz</a>
							</li>
						
							<li>
								<a href="/es_es.html">España</a>
							</li>
						
							<li>
								<a href="/fr_fr.html">France</a>
							</li>
						
							<li>
								<a href="/en_ie.html">Ireland</a>
							</li>
						
							<li>
								<a href="/it_it.html">Italia</a>
							</li>
						
							<li>
								<a href="/en_nl.html">Nederland</a>
							</li>
						
							<li>
								<a href="/en_no.html">Norge (Norway)</a>
							</li>
						
							<li>
								<a href="/pl_pl.html">Polska (Poland)</a>
							</li>
						
							<li>
								<a href="/en_fi.html">Suomi (Finland)</a>
							</li>
						
							<li>
								<a href="/en_se.html">Sverige (Sweden)</a>
							</li>
						
							<li>
								<a href="/tr_tr.html">Türkiye (Turkey)</a>
							</li>
						
							<li>
								<a href="/en_gb.html">United Kingdom</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-4">
					<h4>Asia &amp; Pacific</h4>
					<ul>
						
							<li>
								<a href="/en_au.html">Australia</a>
							</li>
						
							<li>
								<a href="/ru_ru.html">Центральная Азия (Central Asia)</a>
							</li>
						
							<li>
								<a href="/en_hk.html">Hong Kong (English)</a>
							</li>
						
							<li>
								<a href="/zh_hk.html">香港 (中文) (Hong Kong) </a>
							</li>
						
							<li>
								<a href="/en_in.html">भारत गणराज्य (India)</a>
							</li>
						
							<li>
								<a href="/in_id.html">Indonesia</a>
							</li>
						
							<li>
								<a href="/ja_jp.html">日本 (Japan)</a>
							</li>
						
							<li>
								<a href="/ko_kr/business.html">대한민국 (South Korea)</a>
							</li>
						
							<li>
								<a href="/en_my.html">Malaysia</a>
							</li>
						
							<li>
								<a href="/en_us.html">Монголия (Mongolia) and рузия (Georgia)</a>
							</li>
						
							<li>
								<a href="/en_nz.html">New Zealand</a>
							</li>
						
							<li>
								<a href="/en_ph.html">Philippines</a>
							</li>
						
							<li>
								<a href="/en_sg.html">Singapore</a>
							</li>
						
							<li>
								<a href="/zh_tw.html">台灣 (Taiwan)</a>
							</li>
						
							<li>
								<a href="/th_th.html"> ประเทศไทย (Thailand)</a>
							</li>
						
							<li>
								<a href="/vi_vn.html">Việt Nam</a>
							</li>
						
					</ul>
				</div>
			
		</div>
	</div>
</div>




</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-9 column"><div class="horizontalSeparatorV1 section">



<style>
.horizontalSeparator-2cebb92e-7302-49a3-be81-97708ede982e.border {
		border-bottom: 1px solid #bcbdc0;
}
</style>
<div id="horizontalV1-2cebb92e-7302-49a3-be81-97708ede982e" class="global-margin-top- global-margin-bottom-default global-padding-top-default global-padding-bottom- border horizontalSeparator-2cebb92e-7302-49a3-be81-97708ede982e">
	
</div>


</div>
<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-9a447714-a096-4019-bc72-bc06f83574c8">
	<div class="col-sm-12 col-xs-12 col-md-6 column"><div class="text primary-color-white font-interstate-light font-size-14 section">
<div id="privacyLink" class="cmp-text">
    <p><a title="privacy" href="/en_us/about/trust-center/privacy.html">Privacy</a> <b>|</b> <a title="Legal" href="/en_us/about/legal.html">Legal</a> <b>|</b> <a title="Accessibility" href="/en_us/about/legal/accessibility-policy.html">Accessibility</a> <b>|</b> <a title="Site map" href="/en_us/business/sitemap.html">Site map</a></p>

</div>

    

</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-6 column"><div class="text primary-color-white font-interstate-light font-size-14 section">
<div id="copyText" class="cmp-text">
    <p style="text-align: right;">Copyright ©2024 Trend Micro Incorporated. All rights reserved</p>

</div>

    

</div>

</div>
</div>
</div>

</div>
</div>
</div>


	</div>
</div>

	
    
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery/granite.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js"></script>




</div>
</div></div>


			

<!-- /* Core functionality javascripts, absolute URL to leverage Akamai CDN */ -->
<script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js"></script>
<script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js"></script>

<script type="text/javascript" src="https://www.youtube.com/iframe_api"></script>

            
    
    
<script type="text/javascript" src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js"></script>



    


    

    

    
    

            

            
			<!--For Modal-start-->
			<div class="modal-wrap"></div>
			<div class="jwPlayerString hidden">
				<span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk</span>
			</div>
			<!--For Modal-end-->
        

		<!-- Go to www.addthis.com/dashboard to customize your tools -->
		<script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-57bc9d0c3028a052"></script>		
    </body>
</html>
